Equifax left a critical security vulnerability open for quite a while after it was announced, and confirmed that it was used in the breach.

In a statement, Apache Struts wrote, "This vulnerability was patched on 7 March 2017, the same day it was announced ... In conclusion, the Equifax data compromise was due to their failure to install the security updates provided in a timely manner."

https://blogs.apache.org/foundation/entry/media-alert-the-ap...